CVE-2024-1086: Fixes in Linux Kernel
A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation.
The nftverdictinit() function allows positive values as drop error within the hook verdict, and hence the nfhookslow() function can cause a double free vulnerability when NFDROP is issued with a drop error which resembles NFACCEPT.
We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
Other sources
Linux kernel contains a use-after-free vulnerability in the netfilter: nftables component that allows an attacker to achieve local privilege escalation.
— CISA
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by use-after-free flaw in the nftverdictinit() function in the Netfilter subsystem. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F5 F5OSto a version that resolves this vulnerability.Fixed in 1.8.0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade
Linux kernel (netfilter: nf_tables)to a version that resolves this vulnerability.Fixed in f342de4e2f33e0e39165d8639387aa6c19dff660 - Configuration
Disable unprivileged user namespaces (across reboots): echo kernel.unprivileged_userns_clone=0 | sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf. Then apply with sudo sysctl -w kernel.unprivileged_userns_clone=0.
Linux kernel sysctl kernel.unprivileged_userns_clone = 0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-1086?
CVE-2024-1086 is classified as a high-severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2024-1086?
To address CVE-2024-1086, upgrade to the patched versions of the Linux kernel or affected software as detailed in the vendor advisories.
What products are affected by CVE-2024-1086?
CVE-2024-1086 affects various versions of the Linux kernel, F5OS-A, F5OS-C, and IBM QRadar SIEM 7.5.0 UP8 IF01.
Can CVE-2024-1086 be exploited remotely?
CVE-2024-1086 requires local access for exploitation, as it is a use-after-free vulnerability affecting kernel components.
What versions of the Linux kernel are vulnerable to CVE-2024-1086?
CVE-2024-1086 affects Linux kernel versions between 3.15 and 6.8, including specific ranges within those versions.